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IN THE CLAIMS: 

1. (cancelled) 

2. (prwiously presented) The method of claim 10, further comprising: 
not publishing the bait server' s address to the network* 

3. (previously presented) The computer program product of claim 20, wherein the bait 
server's address is not published to the network. 

4. (previously presented) The system as recited in claim 30;, wherein the bait server's 
address is not pubUshcd to the network. 

5» (cancelled) 

6. (cancelled) 

7. (cancelled) 

8. (cancelled) 

9. (cancelled) 

1 0. (previously presented) A method for detecting the presence of a computer virus, the 
method comprising; 

receiving, at a bait server, a request to pcrfbnn a function on the bait server; 
identifying an offending system from which the request originated; 
alerting a local server that a virus attack is in progress and of the identity of the offending 
system; and 

disconnecting the offending system firom the network. 



Page 2 of 15 
ChefUas ct al. - 09/829,761 



PAGE 4/17 ' RCVD AT 9/14/2005 12:38:44 PM [Eastern Daylight Time] ' SVR:USPTO-EFXRF-6/32 ' DNIS:2738300 ' CSID:972 385 7766 ' DURATION (min-ss):0448 



Sep 14 2005 ll;4gRM YEE & RSSOCIflTES, P.C, (972J 385-77SG 



p . 5 



1 1 . (origmal) The method as recited in claim 10, further comprising: 

prior to disconnecting the offending system, notifying the offesnding system that it is 
infected with a virus. 

12. (original) The method as recited in claim 10, further comprising: 
receiving a reconnect request ftom the offending system; 

verifying tiiat Uie offending system is disinfected and available to reconnect to the 
networic; and 

reconnecting the offending system to the network, 

13. (cancelled) 

14. (cancelled) 

15. (cancelled) 

1 6. (previously presented) A method in a bait server for detecting the presence of a computer 
virus, the method cornprising; 

not publishing the bait server^s address to a network; 

monitoring the network for the presence of a computer vuias; 

responsive to a determination that a virus is detected, detemtining the identity of an 
offending system within the network from which the virus entered the network; 

notifying a local server of the presence Of the virus and the identity of the offending 
system; 

instructing all devices within the network to ignore all requests &om the offending system 
until the offending system has been disinfected and is available for network communicatian; 
directing the local server to disconnect the offending system Bcom the network; and 
responsive to an indication that the offending system has been disinfected and responsive 
to a reconnect request from the offending system to the local server, reconnecting the offending 
system to the network. 
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1 7. (previously presented) The method as recited iii claim 10, further comprismg; 
instructing all devices within the network to ignore all requests from the offending system 

until the offending system has been disinfected and is available fornetworic communication. 

18. (cancelled) 

19. (cancelled) 

20. (original) A computer [Program product in a computer readable media for use in a data 
processing system for detecting the presence of a computer virus^ the computer program product 
comprising; 

first instructions for receiving, al a bait server, a request to perform a flinction on the bait 

serv&r; 

second instructions for identifying an ofTending system from which the request 
origiiiated; 

third instrucdons for alerting a local server that a virus attack is in progress and the 
identity of the offending system; and 

foxulh instructions for disconnecting the offending system from a network , 

2 1 . (original) The computer program product as recited in claim 20, further comprising: 
fifth instructions for, prior to disconnecting the ofTending system, notifying the offending 

system that it is infected with a vims. 

22. (original) The computer program product as recited in claim 20, further comprising: 
fifth instructions for receiving a reconnect request fiom the oflbnding system; 

sixth instructions for verifying that the offending system is disinfected and available to 
reconnect to the network; and 

seventh instmctions for reconnecting the offending system to tho network. 

23. (cancelled) 
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24. (cancelled) 

25. (cancelled) 

26. (previously presented) A computer program product in a computer readable media for 
use in a data processing system in a bait server for detecting the presence of a computer virus, the 
computer program product comprising: 

first instructions for not publishing the bait server's address published to a network; 

second instructions for monitoring the network for (he presence of a computer virus; 

third instructions, responsive to a determination that a virus is detected, for determining 
the identity of an offending system within the network from which the virus entered the network; 

fourth instmctions for notifying a local server of the presence of the virus and the identity 
of the offending system; 

fifth instructions for instructing all devices within the network to ignore all requests ftom 
the offending system until the offending system is reauthorized for network communication; 

sixth instructions for directing a local server to disconnect the ofiending system from the 
network; and 

seventh instructions, responsive to an indication that the offending system has been 
disinfected and responsive to a reconnect request from the offending system to the local server, 
for reconnecting the offending system to the network. 

27. (previously presented) The computer program product as recited in claim 20, further 
comprising: 

fifth instructions for instructing all devices within the network to ignore all requests from 
the offending system until the offending system is reauthorized for network communication. 

28. (cancelled) 

29. (cancelled) 
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30. (original) A system for detecting the presence of a computer virus, the system 
comprising; 

a receiver* at a bait server, which receives a request to perform a function on the bait 

server; 

an identifying unit which identifies an offending system fix)m v^rhich the request 
originated; 

an virus aJert unit which alerts a local server that a virus attack is in progress and the 
identity of the offending system; and 

disconnection unit which discoimectB the offending systcna from a network, 

31. (original) The system as recited in claim 30, fUithcr comprising: 

a notification unit which, prior to disconnecting the offending system, notifies the 
offending system that it is mfected with a vims. 

32. (original) The system as recited in claim 30, further comprising: 

a teconnect request unit which receives a reconnect request from the offending system; 
a verification unit which verifies that the offending system is authorized to reconnect to 
the network; and 

a reconnecting unit which reconnects the offending system to the network* 

33. (cancelled) 

34. (cancelled) 

35. (cancelled) 

36. (previously presented) A system in a bait server for detecting the presence of a computer 
virus » the system comprising: 

a monitoring uiiit which monitors a network for the presence of a computer viruSi 
wherein the bait sBrver*s address is not published to the network; 
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an identifier which, responsive to a detertnination that a virus is detected, determines the 
identity of an offending system within the network from which the virus entered the network; 

a notification irnit which notifies a local server of the presence of the virus and the 
identity of the offending system; 

a network protection unit which instructs all devices within the network to ignore all 
requests from the offending system until the offending system is reauthorized for network 
communication; and 

a disconnection unit which directs a local server to discormect the offending system from 
the network* 

a reconnection unit which, responsive to an Indication that the oflfending system has b^n 
disinfected and responsive to a recdimcct request from the offending system to the local server, 
recoAiiects the offending system to the network 

37. (previously presented) The system as recited in claim 30, further comprising: 

a network protection unit which instructs all devices within the network to ignore all 
requests fix>m the offending system imtil the oSending system is reauthorized for network 
comjnunication< 

38. (cancelled) 

39. (cancelled) 
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